Tag Info

Hot answers tagged

18

Yes, bcrypt has a maximum password length. The original article contains this: the key argument is a secret encryption key, which can be a user-chosen password of up to 56 bytes (including a terminating zero byte when the key is an ASCII string). So one could infer a maximum input password length of 55 characters (not counting the terminating zero). ...


9

Yes, BCrypt has an upper limit of 72 characters. It's a limitation by the Blowfish cipher itself. One way to work around it is by using SHA-256 first and then BCrypt the result. In your case it would be something like hashpw(sha256('pass'), salt)


7

Edit: it so happens that the first version of the question was talking about Ken Thompson's classic essay, so my answer was about it, too. It would be a shame to delete it, so I leave it at the end. Now, for the "updated" question: we now speak of something completely different, which is about the easiness of "hiding a backdoor in plain sight", namely in ...


5

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do. The distance from the "metal" is a matter of ...


4

Virtual machines work as sand boxes to keep bad things in, not bad things out. If the host is compromised, so are the containers running within it as the virtual machine has to call out to the host for many actions and the host has full awareness and control over the system running within it.


3

I don't think that the code you are marking is the one achieving to exploit the bug: s.send(struct.pack('>I',len(buff) )) What this line is doing is sending the length of the buffer he is going to send right behind in the proper endiannes (Big Endian or network endiannes). I believe that the exploit itself will have to do with the lengths of the ...


3

Once an attacker already has access to the system it's already way too late. The main concern for not leaking the key is because it is often used as a seed for hashing and signing sessions. The idea is that your production SECRET_KEY needs to be completely different than your development or staging SECRET_KEY. You can actually randomly generate it every ...


3

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell. There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when ...


3

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so ...


3

If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want. Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...


3

This functionality already exists in Nmap, in the pjl-ready-message NSE script. Here's an example usage: nmap -p 9100 --script pjl-ready-message --script-args pjl_ready_message="your message here" 192.0.2.0/24 The script already checks for a real PJL service before sending the command, so you probably don't have to check for OS fingerprint results.


2

How can I implement secure connection between client and my python server? I guess I could use SSH or SSL, but which one will be better suited for the job? And If I choose SSH then wouldn't it interfere with SSH login service I use to manage my (whole) server? If it is only you that will be connecting to the server, I would secure the whole process ...


2

As you ouline, due to the limitaiton of /etc/shadow access, at some level, your application will either have to access that file or access some other module/service which has access to that file. There is no avoiding it if you want a solution which uses locally managed user credentials (unless you totally roll your own, which I strongly recommend avoiding). ...


2

You might want to take a look at the Canari Framework (https://www.canariproject.com/4-3-transform-development-quick-start/). It's an awesomely simple transform development framework that let's you do some pretty rad things ;). UPDATE 1: Canari now has some additional support for complex field types. So far we've added datetime, timespan, color, and date. ...


2

When writing binary output data try instead using open('bomber.out', 'wb').write(data) I can't verify if this will help but it might be worth a try.


2

Your searches must have missed the GitHub repo, which is highlighted on w3af.org. Examples are all there.


2

As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...


2

The best way of dealing with this is to write a custom sqlmap tamper script. You can find examples in the tamper folder. In the script you'll want to make a request to whatever page is generating the random form parameter (or appending to a parameter's value); or if you can truly predict it every time, just have the tamper script generate it itself. So ...


2

The python script connects to the IP 82.94.242.254 on port 8123, authenticates using pass1 and pass2 and then start receiving commands from the C&C. The commands are DOWNLOAD, NIKTO, NMAP, PING, PINGFLOOD, SYNFLOOD and VERSION. Most of these will trigger the execution of a .sh script. From the names we can guess the kind of commands available, which are ...


2

You can write a virus in any language. The condition is the OS vulnerability that is being exploited and the language tools that are available to take advantage of it. "High-level" languages are not 'further' from the OS kernel, but rather they are more abstracted from the kernel from the programmer's point of view. Even Python can access network sockets, ...


2

The Hearbleed security bug (CVE-2014-0160) affects only specific versions of OpenSSL, and nothing else. From OpenSSL Security Advisory [07 Apr 2014], on OpenSSL's web site: Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. So, to answer your question: It depends on whether OpenSSL is used on your system, ...


2

In general there are valid URL schemes that are dangerous. Most obviously javascript:, which as a pseudo-URL refers not to a new location, but to a command to execute on the current page. Allowing a javascript: URL to be added to your page means you have a cross-site scripting problem. There are also other scripting aliases (vbscript:, mocha: et al), as ...


1

You have a bit of a chicken and the egg problem. On one hand you need to store the password on the other hand you don't want it to be readable by just anyone. The problem is that you will either rely on an algorithm or another secret key stored somewhere on your system to obfuscate and de-obfuscate your password. This is security through obscurity and will ...


1

Why would you bother using a bufferoverflow when using Macros? It would be easier to just inject some VB script which does calls to, for instance, powershell (there is a really good exploitation framework here named PowerSploit). Exploits which do target bufferoverflows within Word, are a lot harder to find and exploit. If the target has EMET installed, ...


1

I guess you are referring to ssltest.py that is circulating in the wild. The Client Hello was probably just copied from another packet capture. It is part of the SSL handshake: Client Server ClientHello --------> ServerHello ...


1

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


1

The address in your environment may have changed because the environment is different. You could look at the coredump to find out the correct address to use ( you don't have to use a nop sled then :) )


1

There are multiple benefits using https: More likely that firewalls will accept this traffic, rather than a random port. HTTPS encryption hides what is beeing sent over the network, so IDS/IPS systems will not see what is going on - given that there is no SSL termination (transparent). HTTPS will look more normal in firewall logs. It is not unexpected as ...


1

These books can be a good starting point: Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers Gray Hat Python: Python Programming for Hackers and Reverse Engineers



Only top voted, non community-wiki answers of a minimum length are eligible